Don't access WASP::TeeFilter without a lock.

This can lead to issues when the copy callback has been cleared,
but the old value has already been picked up by the render thread.

BUG=844833
TEST=none

Change-Id: I96cb0f5db1e9b28139e7a148fad135b434b2984b
Reviewed-on: https://chromium-review.googlesource.com/1069489Reviewed-by: Miguel Casas <mcasas@chromium.org>
Commit-Queue: Dale Curtis <dalecurtis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#560801}

media/blink/webaudiosourceprovider_impl.cc

@@ -290,6 +290,9 @@ void WebAudioSourceProviderImpl::SetCopyAudioCallback(
 }
 
 void WebAudioSourceProviderImpl::ClearCopyAudioCallback() {
+  // Use |sink_lock_| to protect |tee_filter_| too since they go in lockstep.
+  base::AutoLock auto_lock(sink_lock_);
+
   DCHECK(tee_filter_);
   tee_filter_->set_copy_audio_bus_callback(CopyAudioCB());
 }

media/blink/webaudiosourceprovider_impl.h

@@ -104,7 +104,8 @@ class MEDIA_BLINK_EXPORT WebAudioSourceProviderImpl
   scoped_refptr<SwitchableAudioRendererSink> sink_;
   std::unique_ptr<AudioBus> bus_wrapper_;
 
-  // An inner class acting as a T filter where actual data can be tapped.
+  // An inner class acting as a T filter where actual data can be tapped. Must
+  // only be accessed while holding |sink_lock_|.
   class TeeFilter;
   const std::unique_ptr<TeeFilter> tee_filter_;